MSTR Defining sets of privileges: Security roles

Security Roles

 Edit 0 1…

https://www2.microstrategy.com/producthelp/10.6/SystemAdmin/WebHelp/Lang_1033/Content/Admin/Defining_sets_of_privileges__Security_roles.htm

Defining sets of privileges: Security roles

A security role is a collection of project-level privileges that are assigned to users and groups. For example, you might have two types of users with different functionality needs: the Executive Users who need to run, sort, and print reports, and the Business Analysts who need additional capabilities to drill and change subtotal definitions. In this case, you can create two security roles to suit these two different types of users.
Security roles exist at the project source level, and can be used in any project registered with Intelligence Server. A user can have different security roles in each project. For example, an administrator for the development project may have a Project Administrator security role in that project, but the Normal User security role in all other projects on that server.
A security role is fundamentally different from a user group in the following ways:

•

A group is a collection of users that can be assigned privileges (or security roles) all at once, for the project source and all projects in it.

•

A security role is a collection of privileges in a project. Those privileges are assigned as a set to various users or groups, on a project-by-project basis.

For information about how privileges are inherited from security roles and groups, see Controlling access to functionality: Privileges.

Managing security roles

The Security Role Manager lists all the security roles available in a project source. From this manager you can assign or revoke security roles for users in projects, or create or delete security roles. For additional methods of managing security roles, see Other ways of managing security roles.

To assign a security role to users or groups in a project

1

In Developer, log in to the project source containing the security role. You must have the Grant/Revoke Privileges privilege.

2

Expand Administration, then Configuration Managers, and then select Security Roles. A list of security roles in the project source opens in the main Developer pane.

3

Double-click the security role you want to assign to the user or group. The Security Role Editor opens.

4

Select the Members tab.

5

From the Select a Project drop-down list, select the project for which to assign the security role.

6

From the drop-down list of groups, select the group containing a user or group you want to assign the security role to. The users or groups that are members of that group are shown in the list box below the drop-down list.

—

By default, users are not shown in this list box. To view the users as well as the groups, select the Show users check box.

—

To assign a top-level group to a security role, from the drop-down list select All Groups.

7

Select a desired user or group.

8

Click the > icon. The user or group moves to the Selected members list. You can assign multiple users or groups to the security role by selecting them and clicking the > icon.

9

When you are finished assigning the security role, click OK. The security role is assigned to the selected users and groups and the Security Role Editor closes.

To create a security role

1

In Developer, log in to the project source you want to create the security role in.

2

Expand Administration, then Configuration Managers, and then select Security Roles.

3

From the File menu, point to New, and select Security Role. The Security Role Editor opens at the General tab.

4

Enter a name and description for the new security role.

5

Select the Privileges tab.

6

Select the privileges to add to this security role. For an explanation of each privilege, see the List of Privileges chapter in the Supplemental Reference for System Administration.

To select all privileges in a privilege group, select the group.

7

To assign the role to users, select the Members tab and follow the instructions in To assign a security role to users or groups in a project.

8

Click OK to close the Security Role Editor and create the security role.

To delete a security role

1

In Developer, log in the project source you want to remove the security role from.

2

Expand Administration, then Configuration Managers, and then select Security Roles. A list of security roles in the project source opens in the main Developer pane.

3

Click the security role that you want to remove.

4

From the File menu select Delete.

5

Click Yes to confirm that you want to delete the security role.

Other ways of managing security roles

You can also assign security roles to a user or group in the User Editor or Group Editor. From the Project Access category of the editor, you can specify what security roles that user or group has for each project.
You can assign roles to multiple users and groups in a project through the Project Configuration dialog box. The Project Access - Generalcategory displays which users and groups have which security roles in the project, and allows you to re-assign the security roles.
For detailed instructions on using these editors to manage security roles, see the MicroStrategy Developer Help.
You can also use Command Manager to manage security roles. Command Manager is a script-based administrative tool that helps you perform complex administrative actions quickly. For specific syntax for security role management statements in Command Manager, see Security Role Management in the Command Manager on-line help (from Command Manager, press F1, or select the Help menu). For general information about Command Manager, see Automating Administrative Tasks with Command Manager.
If you are using UNIX, you must use Command Manager to manage your system’s security roles.

Controlling access to a project

You can deny user or group access to a specific MicroStrategy project by using a security role.

To deny user or group access to a project

1

In Developer, right-click on the project you want to deny access to. Select Project Configuration. The Project Configuration Editor opens.

2

Expand the Project Access category. The Project Access - General dialog box opens.

3

In the Select a security role drop-down list, select the security role that contains the user or group who you want to deny project access. For example, select the Normal Users security role.

4

On the right-hand side of the Project access - General dialog, select the user or group who you want to deny project access. Then click the left arrow to remove that user or group from the security role. For example, remove the Everyone group.

5

Using the right arrow, add any users to the security role for whom you want to grant project access. To see the users contained in each group, highlight the group and check the Show users check box.

6

Make sure the user or group whose access you want deny does not appear in the Selected members pane on the right-hand side of the dialog. Then click OK.

7

In Developer, under the project source that contains the project you are restricting access to, expand Administration, then expand User Manager.

8

Click on the group to which the user belongs who you want to deny project access for. Then double-click on the user in the right-hand side of Developer. The User Editor opens.

9

Expand User Definition, then select Project Access.

10

In the Security Role Selection row, under the project you want to restrict access to, review the Security Role Selection drop-down list. Make sure that no security role is associated with this project for this user.

11

Click OK.

When the user attempts to log in to the project, he receives the message “No projects were returned by this project source.”

The role-based administration model

Beginning with version 9.0, the MicroStrategy product suite comes with a number of predefined security roles for administrators. These roles makes it easy to delegate administrative tasks.
For example, your company security policy may require you to keep the user security administrator for your projects separate from the project resource administrator. Rather than specifying the privileges for each administrator individually, you can assign the Project Security Administrator role to one administrator, and the Project Resource Administrator to another. Because users can have different security roles for each project, you can use the same security role for different users in different projects to further delegate project administration duties.
The predefined project administration roles cover every project-level administrative privilege except for Bypass All Object Security Access Checks. None of the roles have any privileges in common. For a list of the privileges included with each predefined security role, see the List of Privileges chapter in the Supplemental Reference for System Administration.
The predefined administration security roles are:

•

Power Users, which have the largest subset of privileges of any security role.

•

Project Bulk Administrators, who can perform administrative functions on multiple objects with Object Manager (see Copying objects between projects: Object Manager), Command Manager (see Automating Administrative Tasks with Command Manager), and the Bulk Repository Translation Tool.

•

Project Operations Administrators, who can perform maintenance on various aspects of a project.

•

Project Operations Monitors, who can view the various Intelligence Server monitors but cannot make any changes to the monitored systems.

•

Project Resource Settings Administrators, who can configure project-level settings.

•

Project Security Administrators, who create users and manage user and object security.

For instructions on how to assign these security roles to users or groups, see Managing security roles.
Do not modify the privileges for an out-of-the-box security role. During upgrades to newer versions of MicroStrategy, the privileges for the out-of-the-box security roles are overwritten with the default privileges. Instead, you should copy the security role you need to modify and make changes to the copied version.